Supported Resource log categories for Azure Monitor (2024)

FAQs

Supported Resource log categories for Azure Monitor? ›

We will focus on Azure Monitor logs in this article. Within Microsoft Azure, there are two types of logs: Platform logs: the native logs of the Azure platform, made up of activity logs and resource logs. Application logs: the logs developers send from applications to Azure Monitor Logs.

We will focus on Azure Monitor logs in this article. Within Microsoft Azure, there are two types of logs: Platform logs: the native logs of the Azure platform, made up of activity logs and resource logs. Application logs: the logs developers send from applications to Azure Monitor Logs.

The Azure Monitor activity log is a platform log that provides insight into subscription-level events. The activity log includes information like when a resource is modified or a virtual machine is started. You can view the activity log in the Azure portal or retrieve entries with PowerShell and the Azure CLI.

The audit category group allows you to select the resource logs that are necessary for auditing your resource. For more information, see Diagnostic settings in Azure Monitor Resource logs.

The log level. Valid values are Trace, Debug, Information, Warning, Error, or Critical. The integer value of the log level. Valid values are 0 (Trace), 1 (Debug), 2 (Information), 3 (Warning), 4 (Error), or 5 (Critical).

Azure Monitor resource logs are logs emitted by Azure services that describe the operation of those services or resources. All resource logs available through Azure Monitor share a common top-level schema. Each service has the flexibility to emit unique properties for its own events.

Resource logs/Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself.

the level of observation in an eventlog is an event. As a result, attribute values can be stored at the event level. In an activitylog , the level of observation is an activity instance. This means that all additional attributes that you have about your process should be at this higher level.

Where are Azure Monitor logs stored? ›

Logs in Azure Monitor are stored in a Log Analytics workspace that's based on Azure Data Explorer, which provides a powerful analysis engine and rich query language.

Azure Monitor organizes log data in tables, each composed of multiple columns. Every query contains data that's organized into a hierarchy similar to SQL (databases, tables, and columns). The schema provides a simple way to understand data organization in Log Analytics. Automatically, using machine learning algorithms.

To view a near real time stream of application log files generated by your function running in Azure, you can connect to Application Insights and use Live Metrics Stream. Or, you can use the App Service platform built-in log streaming to view a stream of application log files.

The Basic log data plan lets you save on the cost of ingesting and storing high-volume verbose logs in your Log Analytics workspace for debugging, troubleshooting, and auditing, but not for analytics and alerts.

Each Azure resource requires its own diagnostic setting, which defines the following criteria: Sources: The type of metric and log data to send to the destinations defined in the setting. The available types vary by resource type. Destinations: One or more destinations to send to.

Event logs are classified into four categories such as application, security, setup, and system. There's also a special category of event logs called forwarded events. System Log: Windows system event log contains events related to the system and its components.

Depending on the nature and requirements of your project, you may need different kinds of logs, such as issue log, risk log, change log, decision log, action log, or lesson learned log. Each log type should have a clear purpose, scope, and format.